Netskope researchers uncovered a Python remote access trojan that tricks players into running fake Minecraft client software. It uses Telegram for commands, steals Discord tokens, takes screenshots, activates webcams, and opens arbitrary links on infected machines.
Minecraft players who venture outside the official launcher are once again paying the price. Netskope has dropped a detailed report on a new Python RAT that poses as “Nursultan Client,” a real unofficial Minecraft client used by communities in Eastern Europe and Russia. The malware is delivered as a hefty 68.5MB executable compiled with PyInstaller, a common tactic to bloat files and slip past casual scans.
Once executed, the trojan hides its console window on Windows systems and displays a fake installation progress bar referencing the legitimate Nursultan Client. This social engineering buys time while it establishes persistence through registry keys. From there it phones home to a Telegram bot controlled by the attacker, who can issue commands to capture screenshots, activate the webcam, open arbitrary URLs, or rifle through files looking for Discord tokens and browser credentials.
Clear signs this is built for gamers
The choice of Nursultan Client is not random. It is a known name in specific Minecraft circles, making the impersonation effective engineering. The RAT also scans for Discord data specifically, a common target because so many gaming communities live in the app. Netskope notes signs of a malware-as-a-service component where the operator can rent or resell access via unique Telegram IDs.
This campaign continues a pattern seen earlier in 2026 with operations like WeedHack that turned fake mods into credential stealers and remote access tools. The difference here is the tight focus on Discord hijacking and the Telegram C2 channel that gives attackers live control without needing complex infrastructure.
What you should do right now
- Stick exclusively to the official Minecraft launcher from minecraft.net
- Only install mods from trusted repositories like CurseForge or Modrinth with community vetting
- Enable two-factor authentication everywhere, especially Discord
- Run reputable antivirus that catches PyInstaller-packed executables
- If you already ran something suspicious, scan immediately and change passwords from a clean device
Netskope has published indicators of compromise and detection rules. The full Netskope report includes the technical deep dive for anyone running threat hunting in gaming environments. The Minecraft community has dealt with malware waves before. The solution has never changed: stop treating random downloads as harmless fun.